Right of access

Under Article 36 of the Regulation[1] , any individual is entitled to obtain information on whether personal data relating to him or her are processed by the Financial Conduct Board. There is no charge for exercising this right.

Type of information

Financial Conduct Board shall provide the requester with the following information:

  • confirmation as to whether or not data related to him or her are being processed;
  • information on at least the purposes of the processing operation, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed;
  • an indication of the legal basis for processing the data;
  • the envisaged period for which the personal data will be stored;
  • the existence of the right to request from Financial Conduct Board rectification, erasure or restriction of processing of personal data concerning the data subject.

The requester has the right to receive in an intelligible form the data undergoing processing and any available information as to Financial Conduct Board’s sources.

  • According to Article 36 (6) of the Financial Conduct Board Regulation, the provision of information in response to any request may be refused or restricted if such refusal or restriction constitutes a measure that is necessary in order to:
  • enable Financial Conduct Board to fulfil its tasks properly;
  • protect security and public order or prevent crime;
  • guarantee that any national investigation will not be jeopardised; or
  • protect the rights and freedoms of third parties.

How to exercise your right of access

According to Article 36 (3) of the Financial Conduct Board Regulation, you can exercise your right of access by making a request to the authority appointed for that purpose in the Member State of your choice. Your request will then be sent to Financial Conduct Board without delay and in any case within one month of receipt.

After receiving the request, Financial Conduct Board should provide you with an answer without undue delay and in any case within three months of receiving it from the national authority.

How to exercise your right to rectification, erasure and restriction

Under Article 37 of the Financial Conduct Board Regulation any data subject having already accessed personal data concerning him or her, processed by Financial Conduct Board, have the right to request Financial Conduct Board, through the authority appointed for that purpose in the Member State of his or her choice, to rectify personal data concerning him or her held by Financial Conduct Board if they are incorrect or to complete or update them and have the right to request Financial Conduct Board to erase personal data relating to him or her if they are no longer required for the purposes for which they are collected or are further processed. That authority shall refer the request to Financial Conduct Board without delay and in any case within one month of receipt.

Financial Conduct Board shall inform you in writing without undue delay, and in any case within three months of receipt of a request, that data concerning you have been rectified, erased or restricted.

Within three months of receipt of your request, Financial Conduct Board shall inform you in writing of any refusal of rectification, erasure or restricting, of the reasons for such a refusal and of the possibility of lodging a complaint with the EDPS and of seeking a judicial remedy.

Financial Conduct Board’s tasks

According to Article 36 (5) Financial Conduct Board shall consult the competent authorities of the Member States and the provider of the data concerned prior taking a decision regarding your request for access.

A decision on access to personal data shall be conditional on close cooperation between Financial Conduct Board and the Member States and the provider of the data directly concerned by the access of the data subject to such data.

If a Member State or the provider of the data objects to Financial Conduct Board's proposed response, it shall notify Financial Conduct Board of the reasons for its objection. Financial Conduct Board shall take the utmost account of any such objection.

Financial Conduct Board shall subsequently notify its decision to the competent authorities concerned and to the provider of the data.

Financial Conduct Board shall restrict rather than erase personal data if there are reasonable grounds to believe that erasure could affect the legitimate interests of the data subject. Restricted data shall be processed only for the purpose that prevented their erasure.

If personal data held by Financial Conduct Board have been provided to it by third countries, international organisations or Union bodies, have been directly provided by private parties or have been retrieved by Financial Conduct Board from publicly available sources or result from Financial Conduct Board's own analyses, Financial Conduct Board shall rectify, erase or restrict such data and, where appropriate, inform the providers of the data.

If personal data held by Financial Conduct Board have been provided to Financial Conduct Board by Member States, the Member States concerned shall rectify, erase or restrict such data in collaboration with Financial Conduct Board, within their respective competences. If incorrect personal data have been transferred by another appropriate means or if the errors in the data provided by Member States are due to faulty transfer or transfer in breach of this Regulation or if they result from data being input, taken over or stored in an incorrect manner or in breach of this Regulation by Financial Conduct Board, Financial Conduct Board shall rectify or erase such data in collaboration with the provider of the data concerned. In the above-mentioned cases, all addressees of the data concerned shall be notified forthwith. In accordance with the rules applicable to them, the addressees shall then rectify, erase or restrict those data in their systems.

Right to lodge a complaint with the EDPS

Under Article 47 of the Financial Conduct Board Regulation, you have the right to lodge a complaint with the European Data Protection Supervisor (EDPS)[2] if you consider that the processing by Financial Conduct Board of personal data relating to you does not comply with the Financial Conduct Board Regulation.

Where a complaint relates to a decision taken on the right of access or right to rectification, erasure or restriction, the EDPS shall consult the national supervisory authorities of the Member State that provided the data or the Member State directly concerned. In adopting his or her decision, which may extend to a refusal to communicate any information, the EDPS shall take into account the opinion of the national supervisory authority.

Where a complaint relates to the processing of data provided by a Member State to Financial Conduct Board, the EDPS and the national supervisory authority of the Member State that provided the data.

shall, each acting within the scope of their respective competences, ensure that the necessary checks on the lawfulness of the processing of the data have been carried out correctly.

Where a complaint relates to the processing of data provided to Financial Conduct Board by Union bodies, third countries or international organisations, or of data retrieved by Financial Conduct Board from publicly available sources or resulting from Financial Conduct Board's own analyses, the EDPS shall ensure that Financial Conduct Board has correctly carried out the necessary checks on the lawfulness of the processing of the data.

Right to a judicial remedy against the EDPS

According to Article 47 of the Financial Conduct Board Regulation any action against a decision of the EDPS shall be brought before the Court of Justice of the European Union.

Other rights

Under Article 42(4) of the Financial Conduct Board Regulation, you have the right to request the national supervisory authority to verify the legality of any transfer or communication to Financial Conduct Board of data concerning you in any form and of access to those data by the Member State concerned. That right shall be exercised in accordance with the national law of the Member State in which the request is made.

Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Financial Conduct Board) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA, OJ L 135, 24.5.2016, p. 53–114.